November 2026 Patch Tuesday: Exploited Outlook Zero-Day Requires Office Update

Which total is right: 1,092, 1,093 or 1,094?​

Sources disagree on the size of this month's release, so here is each count and where it comes from:

• IT Brief (UK, Asia and Australia editions) says Microsoft published 1,092 vulnerabilities. The same story quotes Rapid7's Adam Barnett as saying the release includes 1,102 Windows vulnerabilities. That's more than the headline total, so at least one of those figures needs a footnote.
• KrebsOnSecurity counts 1,093 fixes, with 63 rated critical and 535 privilege-escalation bugs. Krebs says nearly half of the critical flaws are remote code execution issues.
• The Register puts the count at 1,094, noting it is the second month of more than 1,000 CVEs (October had 1,474).
• Splashtop also counts 1,094 and adds that Microsoft is also republishing 165 non-Microsoft CVEs. Another tracker lists 1,094 Microsoft CVEs excl. Edge & Azure Linux, with 64 critical.

The likely explanation is methodology. Some trackers include Edge, Azure Linux and republished third-party CVEs, and others leave them out. None of the sources fully reconciles the numbers, so treat "about 1,100" as the honest figure. Krebs adds that Microsoft has now shipped more than 5,100 security patches in 2026. He contrasts that with roughly 100 a month a year ago, and says Microsoft credits AI-assisted bug hunting for the jump.

Section summary: the headline total varies by roughly two to three CVEs depending on what each tracker counts. All of them agree on one exploited zero-day and no publicly disclosed flaws.

CVE-2026-124194: the Outlook bug attackers are already using​

Here is how the flaw works, according to Barnett at Rapid7. Opening a specially crafted malicious file makes classic Outlook connect silently to a location the attacker controls, and that leaks the user's NTLMv2 hash. Barnett says it affects all supported versions of classic Outlook. Krebs reports that Microsoft's advisory lists Microsoft 365 Apps for Enterprise and editions of Microsoft Office.

Dustin Childs of the Zero Day Initiative described the attack to The Register: "Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user's NTLMv2 hash. The attacker can use that hash to authenticate as the user." Microsoft's formal description says the "product UI does not warn user of unsafe actions in Microsoft Office Outlook," and the weakness maps to CWE-356.

Why prioritize a bug with a CVSS score of 6.5 and a "Moderate" rating?

• Exploitation is confirmed. CISA added CVE-2026-124194 to its Known Exploited Vulnerabilities catalog on November 10, 2026, with a remediation due date of November 24, 2026 for federal agencies.
• A leaked hash is useful to attackers. Barnett notes it can be used to impersonate the user against another service or cracked offline.
• Severity ratings don't reflect exploitation. Splashtop points out that for the third month in a row, the vulnerability attackers are actually using is rated below Critical, which is why exploit status should set the order of work.

There is one limiting factor. Barnett says the Preview Pane is not an attack vector, so the user has to actually open the file. That gives some protection, but not much. Getting people to open things is what phishing is for.

The Register notes that Microsoft didn't say when the attacks started, who is battering this bug, and what they are doing with the access post exploitation. Don't read anything into the silence. It isn't evidence of a narrow campaign or of a broad one.

How to patch it: the fix comes through Office, not Windows Update​

This is the step most likely to go wrong. Splashtop says the fix ships in the Microsoft 365 Apps and Office LTSC 2021 and 2024 security updates. TheTechHacker puts it more bluntly: the fix doesn't come through Windows Update at all, it comes through Office's own updater, which a lot of people never look at.

On a single PC:

1. Open Outlook (or Word).
2. Go to File > Account > Update Options > Update Now.
3. Let the update finish, then restart Office apps when prompted.
4. Run Windows Update separately for the OS fixes listed below.

For administrators:

1. List every device running classic Outlook, including Microsoft 365 Apps and Office LTSC installs.
2. Push the November Office security update through your usual channel, whether that's Intune, Configuration Manager or something else.
3. Check that devices actually reached the patched build. Don't assume Click-to-Run handled it on its own.
4. Several trackers suggest a 72-hour target for this one, which is well ahead of CISA's November 24 federal deadline.
5. For threat hunting, Rescana suggests that unexpected Outlook connections to unknown locations, or NTLM events after a user opens a message file, may be leads for CVE-2026-124194, not confirmed signatures.

Users should also hear the usual warning about unexpected message-file attachments. That's an extra layer, not a substitute for patching.

The Windows flaws that deserve attention next​

Rapid7 flagged two Windows bugs that could cause trouble even though neither is exploited yet:

• CVE-2026-119952 (Schannel): a pre-authentication remote code execution flaw in Windows' TLS implementation, triggered by specially crafted packets. Microsoft's advisory says specific conditions are required for exploitation. Barnett points out that Microsoft still rates exploitation "more likely," and that an attacker may often not need a foothold on the same subnet. Because Schannel runs on so many endpoints, the exposure could be wide.
• CVE-2026-116928 (Exchange plus Windows Search): pre-auth RCE on an Exchange server through a malicious attachment that Windows Search indexes automatically on Exchange's behalf. The fix is in Windows, not Exchange, so patching Exchange alone won't cover you. Barnett also reminds admins that only Exchange Subscription Edition is still supported.

Rescana's advisory adds an LDAP RCE, CVE-2026-119958, to that list. It says Microsoft marks all three as not exploited and not publicly disclosed.

Section summary: patch Outlook first, then move fast on Windows servers. Exchange hosts and machines with heavy TLS exposure come first.

Lifecycle changes and what else shipped this week​

According to Barnett, .NET 8 LTS, PowerShell 7.4 LTS and Windows 11 Enterprise, Education and IoT editions have moved past their end dates. If you still run any of them, they don't appear in this month's patch reports and won't get fixes from here on.

Other vendors also patched this week. Krebs reports:

• Chrome 157.0.8103.50 fixes CVE-2026-125350, Chrome's sixth zero-day of the year. It affects Chromium-based browsers, including Edge, so check your Edge version too.
• Firefox 160 fixes almost 100 CVEs.
• Adobe patched at least 110 vulnerabilities.
• Apple shipped out-of-band iMessage fixes.

Analysis: is more patching making anyone safer?​

Barnett questions the volume himself. In his view, every code change that removes a known flaw could introduce new ones for researchers or attackers to find later. The other side of the argument comes from Ivanti's Chris Goettl, quoted by Krebs. About 95,000 CVEs have been assigned across all vendors this year, but only 217 have reached CISA's KEV list. His conclusion is that teams should focus hard on the small set of flaws attackers are actually using.

For November, that means getting the Office update onto every device running Outlook, then working through the Windows server patches. The other thousand-odd fixes can go out on the normal schedule. Back up first, as always.